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Preface 


The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the Department. 


This report addresses the strengths and weaknesses of DHS’ Intelligence Community 
members’ Continuity of Operations programs. It is based on interviews with employees 
and officials of relevant agencies and institutions, direct observations, and a review of 
applicable documents. 


The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 


n E Fost 


fles KI. Edwards 
Acting Inspector General 
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Executive Summary 


The Department of Homeland Security’s (DHS) Office of 
Intelligence and Analysis (I&A) and the United States Coast 
Guard’s (USCG) Office of Intelligence and Criminal 
Investigations share the common function of performing as DHS 
departmental elements and Intelligence Community members. 


We assessed the DHS Intelligence Community members’ 
Continuity of Operations programs as part of our Fiscal Year 2011 
Annual Performance Plan. Specifically, we focused on the 
program’s history, evolution, activities, and coordination and 
collaboration efforts. Our objectives were to ensure Continuity of 
Operations definition alignment with the National Continuity 
Policy; to ensure that plans adequately address requirements set 
forth in the National Continuity Policy; to determine whether 
Continuity of Operations training and exercises test capabilities 
and identify potential areas of improvement; and to determine 
whether new planning efforts incorporate lessons learned and 
corrective action resulting from prior exercises or actual events. 


The plans of both I&A and USCG address the required areas that 
define a viable Continuity of Operations plan and are consistent 
with national directives and DHS guidance. Senior leadership for 
both components have effectively assessed their programs and are 
confident that Continuity of Operations functions will be 
performed and sustained during emergency situations. However, 
both the Office of Intelligence and Analysis and USCG 
Intelligence and Criminal Investigations Continuity of Operations 
plans can be strengthened by defining roles and responsibilities 
better, adding more realistic exercise scenarios, and updating plans 
to reflect current operational capabilities. 


We are making eight recommendations to help DHS Intelligence 
Community members strengthen their Continuity of Operations 
plans and programs and to improve oversight. The Department 
concurred with seven recommendations and did not concur with 
one. 
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Background 


The terrorist attacks of September 11, 2001, and hurricanes Katrina 
and Rita in 2005 are examples of mass destruction and chaos 
caused by manmade and natural disasters. In November 2009, 
shootings at Fort Hood in Killeen, Texas, exemplified the ongoing 
threat of radicalized domestic extremism, further evidenced by the 
December 2009 Christmas Day bombing attempt on board 
Northwest Flight 253. The death of Osama Bin Laden in May 
2011 and other recent events have not curtailed global terrorist 
activities against the United States or its foreign interests. The 
threat of terrorism and natural events beyond our control are two 
primary reasons why the Federal Government relies on Continuity 
of Operations (COOP) plans. COOP plans enable a more rapid 
and effective response to and recovery from an emergency, 
regardless of cause, size, or complexity. 


DHS has five missions: 


e Preventing terrorism and enhancing security 

e Securing and managing our borders 

e Enforcing and administering our immigration laws 
e Safeguarding and securing cyberspace 

e Ensuring resilience to disasters 


To accomplish its missions, DHS must perform operations 
efficiently and effectively, with minimal disruption of essential 
functions, especially during any type of disaster or emergency. 
The severity and consequences of a disaster or emergency are 
difficult to predict, but effective contingency planning can 
minimize the effect on DHS personnel, resources, and operations. 


National Continuity Policy 


The U.S. Government’s National Continuity Policy, as outlined in 
the May 7, 2007, National Security Presidential Directive 51 
(NSPD-51)/Homeland Security Presidential Directive (HSPD-20), 
establishes as national policy the requirement for each department 
and agency of the executive branch to maintain a comprehensive 
and effective continuity capability composed of Continuity of 
Government and COOP programs. These programs are to ensure 
the preservation of our form of government under the Constitution, 
including the functioning of the three separate branches, and the 
continuing performance of National Essential Functions under all 
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conditions. National Essential Functions, as defined in NSPD- 
51/HSPD-20, represent the overarching responsibilities of the 
Federal Government to lead and sustain the Nation during a 
catastrophic emergency and will be the primary focus of the 
Federal Government’s leadership during and in the aftermath of an 
emergency. 


Continuity of Government refers to a coordinated effort within the 
executive branch to ensure that National Essential Functions 
continue to be performed during a catastrophic disaster or 
emergency. COOP refers to an effort within individual executive 
departments and agencies to ensure that Primary Mission-Essential 
Functions continue to be performed during a wide range of 
disasters or emergencies.’ When a disaster, emergency, or 
significant event occurs, COOP procedures may be initiated. Upon 
COOP activation, mission-essential personnel will receive 
information pertaining to the threat condition, whether to report to 
an alternate site, and if so, the reporting time. Once personnel are 
present at the alternate site, they will continue to perform their 
organization’s Primary Mission-Essential Functions. 


National Essential Functions 


National Essential Functions must be maintained at all times, while 
Primary Mission-Essential Functions are unique to each department 
and agency. There are eight National Essential Functions: 


e Ensuring the continued functioning of the Federal 
Government under the Constitution, including the 
functioning of the three separate branches of government; 


e Providing leadership visible to the Nation and the world 
and maintaining the trust and confidence of the American 
people; 


e Defending the Constitution of the United States against all 
enemies, and preventing or interdicting attacks against the 
United States or its people, property, or interests; 


' Primary Mission-Essential Functions, as defined in NSPD-51/HSPD-20, are those department and agency 
Mission-Essential Functions that must be performed to support or implement the performance of the 
National Essential Functions before, during, and in the aftermath of an emergency. They are required to be 
performed continuously during an event or resumed within 12 hours of an event, and to be maintained for 
up to 30 days after an event or until the resumption of normal operations. 
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e Maintaining and fostering effective relationships with 
foreign nations; 


e Protecting against threats to the homeland and bringing to 
justice perpetrators of crimes or attacks against the United 
States or its people, property, or interests; 


e Providing rapid and effective response to and recovery 
from the domestic consequences of an attack or other 
incident; 


e Protecting and stabilizing the Nation’s economy and 
ensuring public confidence in its financial systems; and 


e Providing for critical Federal Government services that 
address the national health, safety, and welfare needs of the 
United States.” 


Resources required to perform National Essential Functions 
include trained personnel, equipment, and consumable office 
supplies.’ The proper identification and prioritization of these 
functions are critical for creating a viable COOP plan. When 
departments and agencies identify too many functions as essential, 
resources may be allocated to sustain nonessential functions, 
impeding work on essential tasks. 


National Continuity Policy Implementation Plan and Federal 
Continuity Directive 


In August 2007, the President approved the National Continuity 
Policy Implementation Plan. This plan augments the National 
Continuity Policy and provides guidance to executive branch 
departments and agencies on identifying and executing their 
Primary Mission-Essential Functions. To provide operational 
guidance in implementing this policy, the Federal Emergency 
Management Agency (FEMA) within DHS coordinated with its 
interagency partners and developed the Federal Continuity 
Directive-1 (FCD-1), Federal Executive Branch National 
Continuity Program Requirements (February 2008). FCD-1 
provides direction to executive branch departments and agencies 


? NSPD-51/HSPD-20 § (5)(a)-(h). 

? Essential Functions include all activities and resources necessary to support and maintain National 
Essential Functions and department- and agency-specific Primary Mission-Essential Functions and 
Mission-Essential Functions. 
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on identifying and implementing the requirements to maintain a 
COOP capability.* 


FCD-| states that a viable COOP program will include the 
following 10 elements: 


Essential functions 

Alternate operating facilities 

Delegations of authority 

Orders of succession 

Devolution planning 

Vital records management 

Interoperable communications 

Test, training, exercise, and evaluation program 
Human resources and capital 

Reconstitution 


At the request of the Assistant Inspectors General for Inspections 
Working Group of the Intelligence Community (IC) Inspectors 
General Forum, all IC Offices of Inspectors General (OIGs) agreed 
to conduct evaluations of COOP and Intelligence Readiness 
programs for their respective departments and agencies. These 
evaluations were to assess COOP programs and capabilities for 
elements in each organization that are funded by the National 
Intelligence Program.” 


The IC members represent 16 different Federal Government 
departments and agencies. DHS has two IC members: the I&A 
and the U.S. Coast Guard Intelligence and Criminal Investigations 
(USCG CG-2). DHS IC members are the conduit between the IC 
and other DHS components. I&A and USCG CG-2 are 
responsible for ensuring the integration and continuity of 
intelligence to and from the IC during regular operational periods 
and national disasters and emergencies. I&A and USCG CG-2 
have the unique ability to function as both departmental 
components and IC members in times of national disasters and 
emergencies. 


* FCD-1’s provisions apply to the executive departments listed in 5 U.S.C. § 101, including DHS; 
independent establishments as defined by 5 U.S.C. § 104(1); government corporations as defined in 
5 U.S.C. § 103(1); and the U.S. Postal Service. Throughout this report, we refer to these entities as 
“departments and agencies.” 

` The National Intelligence Program funds intelligence activities in several Federal departments and 
agencies. Detailed funding requests for intelligence activities are classified. 
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We reviewed COOP and Intelligence Readiness programs for I&A 
and USCG CG-2 to determine the following: 


e Whether the COOP definitions used align with the National 
Continuity Policy; 


e The extent to which the IA and USCG CG-2 COOP plans 
address the requirements set forth in the National 
Continuity Policy; 


e Whether COOP training and exercises test capabilities and 
identify potential areas of improvement; and 


e Whether new planning efforts incorporate lessons learned 
and corrective action resulting from prior exercises or 
actual events. 


Our report addresses DHS IC member efforts and capabilities, not 
the Department’s overall COOP plan and program. However, we 
reviewed DHS’ and USCG’s plans to ensure that I&A and USCG 
CG-2 plans are included in the Department and USCG plans. 


Results of Review 


I&A and USCG CG-?2 have provided effective oversight of their respective COOP 
programs. Both have reviewed and confirmed component-specific Essential 
Functions, reviewed office-level COOP plans, and prepared multiyear strategies 
and management plans to guide each program. Neither I&A nor USCG CG-2 
distinguishes between Primary Mission-Essential Functions and Mission-Essential 
Functions; they consider all critical mission functions to be Essential Functions. 
Senior leadership of both components is engaged in building viable COOP plans. 
I&A and USCG CG-2 COOP program officials say that their COOP plans allow 
both components to maintain a successful COOP posture and execute their 
Essential Functions during a significant national event. Continuity planning is 
consistent because both components’ policies define authorities and responsibilities 
to reflect current national directives and guidance. I&A and USCG CG-2 COOP 
training and exercises are sufficient to prepare and assess component abilities to 
provide essential services during a significant emergency. However, improvements 
can be made to better define roles and responsibilities, enhance exercises to 
simulate real-world events, and update plans to reflect current operational 
capabilities. 
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Both plans are centric to operations and sustainment of the Department and not 
the IC. There are no interagency or IC-level Mission-Essential Functions in 
I&A’s plan, but USCG CG-2 has one plan that supports all essential requirements 
tasked to USCG. Both I&A and USCG CG-2 receive and transmit information to 
other IC departments and agencies that assist in ensuring that DHS Mission- 
Essential Functions are met. Figure 1 lists the national, DHS, I&A, and USCG 
CG-2 Essential Functions. 


Figure 1: Essential Functions: National, DHS, I&A, and USCG CG-2 


Ensuring the continued functioning of our form of government under the Constitution, including the functioning of the three separate branches of government. 
Provide leadership that is visible to the Nation and the world and maintaining the trust and confidence of the American people. 

Defending the Constitution of the United State against all enemies, foreign and domestic, and preventing or interdicting attacks against the United States or its 
people, property, or interests, 

Maintaining and fostering effective relationships with foreign nations. 

Protecting against threats to the homeland and bringing to justice perpetrators of crimes or attacks against the United States or its people, property, or interests, 
Providing rapid and effective response to the recovery from the domestic consequences of an attack or other incident. 

Protecting and stabilizing the Nation's economy and ensuring public confidence in its financial systems. 

Providing for critical Federal Government services that address the national health, safety, and welfare needs of the United States. 


Awareness: Identify and understand threats, assess vulnerability, determine impacts, and disseminate timely information, 

Prevention: Detect, deter, and mitigate threats. 

Protection: Safeguard our people and their freedoms, critical infrastructures, property and the economy of our nation from acts of terrorism, natural disasters, and 
other emergencies, 

Response: Lead, manage, and coordinate the national response to acts of terrorism, natural disasters, and other emergencies. 

Recovery; Lead national, state, local, and private sector efforts to restore services and rebuild communities after acts of terrorism, natural disasters, or other 
emergencies. 


Assess, integrate, analyze, and exchange timely, relevant, and actionable threat and warning intelligence with federal, state, local, tribal, territorial, and private 
sector partners. 

Support the prevention of terrorist attacks through the analysis and exchange of terrorism-related intelligence with our federal, state, local, tribal, territorial, and 
private sector partners. 

Support the prevention of unauthorized acquisition or use of chemical, biological, radiological, and nuclear (CBRN) materials through the analysis and exchange 
of CBRN-related intelligence with our federal, state, local, tribal, territorial, and private sector partners. 

Support the protection of the U.S. critical infrastructure and key resources (CIKR) through the analysis and exchange of CIKR-related intelligence with our federal, 
state, local, tribal, terroritorial, and private sector partners. 

Support the safeguarding and securing of cyberspace through the analysis and exchange of cyber-related intelligence with our federal, state, local, tribal, 
territorial, and private sector partners. 

Support the securing of our borders through the analysis and exchange of border-related intelligence with our federal, state, local, tribal, territorial, and private 
sector partners. 


Protective Services Operations for CCG and VCG (or Alternates) 

Intelligence Support to CG Senior Leadership and DHS 

Intelligence Systems / Information Technology and Related Connectivity 

Physical / Personnel Security Systems and Safeguards 

Intelligence support to Area and Subordinate Field Commanders 

Investigative Operations in Support of Area and Subordinate Field Commanders 

Counterintelligence Operations 

Intelligence Community Requirements; Continue to support all essential Intelligence Community requirements tasked to the CG. 


Source: NSPD-51/HSPD-20, DHS, I&A, and USCG CG-2. 


Office of Intelligence and Analysis 


I&A was created in 2003 and is responsible for ensuring that timely and 
actionable homeland security information and intelligence is provided to 
national leadership, as well as State, tribal, local, and private sector 
stakeholders. I&A has 15 divisions organized under three Deputy Under 
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Secretaries and one directorate, as reflected in figure 2. I&A defines 
COOP as the ability of the office and its leadership to continue performing 
I&A Essential Functions in the event that its headquarters is inaccessible 
or uninhabitable. I&A must establish an operational capability and 
perform Essential Functions within 12 hours of COOP activation and 
sustain those functions up to 30 days or until resumption of normal 
operations. 


Figure 2: I&A Organizational Structure 


DHS Office of Intelligence and Analysis (I&A) as of October 2011 


Chief of Staff (COS) 
Deputy Chief of Staff (DCOS) 


Source: I&A. 


COOP Program Evolution 


From 2003 to 2007, I&A’s COOP program functioned more in theory than 
in practice. This is attributed to unclear guidance from senior leaders and 
the fact that designated COOP managers did not completely understand 
how COOP programs are developed and maintained. 
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In 2007, I&A hired a COOP staff who are trained to develop, maintain, 
and execute its COOP program within established directives and policies. 
As a result, I&A has identified and defined Essential Functions, 
participated in government-wide and internal COOP exercises, and 
conducted periodic informational meetings to identify its level of COOP 
preparedness. I&A officials said that they maintain a level of COOP 
capability that would sustain the performance of Essential Functions. 


I&A has identified an Emergency Relocation Group (ERG) to ensure the 
continuation of I&A’s Essential Functions in the event of a COOP 
activation and execution. When I&A operations are disrupted, the I&A 
Under Secretary or a designated successor may activate its COOP plan. 
Upon notification of a COOP situation, the ERG will relocate to the 
designated alternate operations facility site to continue I&A’s Essential 
Functions. 


I&A’s COOP plan also includes ERG intelligence elements from other 
DHS components. In 2008, DHS’ Chief Intelligence Officer established 
the Intelligence Enterprise Continuity Working Group. The working 
group is responsible for developing plans and procedures to ensure that 
DHS intelligence elements are able to operate cohesively and effectively 
to respond to all-hazard emergencies. I&A collaborates with the DHS 
intelligence element to provide intelligence support to national and 
homeland security leaders, while supporting Federal, State, local, territorial, 
tribal, and private sector partners and customers.° In addition to I&A and 
USCG CG-2, the DHS intelligence element consists of the following: 


e U.S. Customs and Border Protection’s Office of Intelligence and 
Operations Coordination 

e U.S. Immigration and Customs Enforcement’s Office of Intelligence 

e Transportation Security Administration’s Office of Intelligence 
and Analysis 

e USS. Citizenship and Immigration Services’ Office of Fraud 
Detection & National Security 

e United States Secret Service’s Office of Strategic Intelligence and 
Information 


In I&A, 8 of the 15 divisions have individual Incident Management plans 
that align with the overall I&A headquarters COOP plan.’ The Homeland 
Counterterrorism, Current Intelligence, and Cyber, Infrastructure, and 
Science Divisions are relatively new and are drafting Incident 


° U.S. Department of Homeland Security Intelligence Enterprise Continuity Draft Plan, June 2011. 
7 Incident Management plans detail how an organization will respond to emergency situations during 
Continuity of Operations events. 
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Management plans as of November 2011. The State and Local Program 
Office Incident Management plan covers its two divisions, and the 
Program Performance and Management and Strategy, Plans, and Policy 
Divisions do not have any Essential Functions or ERG personnel. 


Support and Planning Efforts 


COOP is a priority for I&A leadership and has consistent senior 
and midlevel leadership support. I&A has a 2010 COOP plan that 
addresses all FCD-1 elements, although the sections concerning 
devolution and vital records are not fully developed. COOP 
program officials believe that an I&A policy should be developed 
to direct each internal I&A office and division to develop and 
maintain COOP plans. The policy should also provide 
documentation of nonoperational program requirements, to allow 
the updated I&A COOP plan to focus on operational requirements 
and ensure that continuity applies to all I&A personnel and not just 
ERG members. 


COOP planning occurs at all I&A levels. The Continuity and 
Exercise Programs Branch manages I&A’s COOP program. 
Program managers collaborate with I&A management to build 
COOP awareness and support. 


I&A COOP program managers are former FEMA employees who 
are trained in all aspects of continuity operations. Contingency 
Plans and Exercise Branch personnel are capable of developing, 
executing, and maintaining a COOP program. Primary duties for 
I&A COOP program managers are building and sustaining COOP 
capabilities. Maintaining division-level COOP responsibilities is 
an additional duty. All division-level managers possess functional 
COOP program knowledge, with some possessing expert 
knowledge in maintaining a program. As a result, I&A officials 
said they have improved the accountability, oversight, and 
visibility of their COOP program. 


Working Group Collaboration 


I&A participates in several DHS and Office of Director of National 
Intelligence COOP working groups.* The Office of Director of 
National Intelligence working groups include the National 


* The Director of National Intelligence serves as the head of the IC, overseeing and directing National 
Intelligence Program implementation and acting as the principal advisor to the President, the National 
Security Council, and the Homeland Security Council for intelligence matters related to national security. 
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Intelligence Emergency Management Activity, the National 
Partners Advisory Group, and the Mission Technical Advisory 
Committee. The National Intelligence Emergency Management 
Activity focuses on Continuity of Government, while the National 
Partners Advisory Group focuses on the critical IC and non-IC 
support departments and agencies. The Mission Assurance 
Technology Committee focuses on information technology. 


DHS-led COOP working groups consist of the Interagency 
Continuity Test, Training, and Exercise Working Group, which is a 
FEMA-led forum that coordinates executive branch continuity 
issues, and the Department of Homeland Security Working Group, 
which is led by DHS’ Office of Operations Coordination and 
Planning and coordinates all DHS continuity issues. I&A also 
participates in the Office of Intelligence and Analysis Continuity 
Working Group, which coordinates I&A continuity issues, and the 
DHS Intelligence Enterprise Continuity Working Group, which 
coordinates I&A Intelligence Elements continuity issues. 


According to I&A COOP program and division managers, 
participation in these working groups and the exchange of ideas 
and information help I&A form a concerted and cohesive COOP 
plan that is in accordance with Federal regulations and Federal and 
Department policies. 


Implementing Federal Continuity Directive-1 Requirements 
Essential Functions 


FCD-1 requires departments and agencies to identify and prioritize 
their organization’s Essential Functions as a basis for COOP 
planning, and to identify staffing, resource requirements, and other 
supporting activities necessary to perform such functions. By 
identifying and prioritizing Essential Functions, a department or 
agency establishes planning parameters that drive its efforts in all 
other planning and preparedness areas. Mission-Essential 
Functions are a broad set of Essential Functions that include not 
only an agency’s Primary Mission-Essential Functions, but also all 
other functions that must be continued throughout or resumed after 
a disruption of normal activities but do not rise to the level of 
Primary Mission-Essential Functions. 


DHS?’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 


Page 11 


I&A’s COOP plan prioritizes Essential Functions based on their 
criticality or time sensitivity according to likely COOP triggers and 
scenarios. I&A officials periodically review Essential Functions to 
ensure that mission continuity is met under all conditions. In 2010, 
I&A reviewed its Essential Functions and determined that they 
were adequate for I&A to continue its mission. That review 
included analyzing, prioritizing, and identifying interdependencies 
and required resources. In July 2012, I&A, along with the other 
DHS components, will be reviewing and assessing their Essential 
Functions to better enable the Department to perform mission- 
critical functions during and following a real-world emergency. 


The eight divisions that have COOP plans each have Essential 
Functions listed in their plan. However, the different division 
Essential Functions are not listed in the overall I&A COOP plan. 
Should senior leadership need to determine a specific division 
function, they would have to review each plan, potentially losing 
critical time during a COOP event. 


Alternate Operating Facilities 


FCD-1 requires department and agency COOP plans to identify 
and prepare alternate operating facilities where staff can perform 
their Essential Functions. The alternate operations facility must be 
functional within 12 hours of COOP activation and sustainable for 
at least 30 days. These facilities should be located away from 
vulnerable areas and provide support, infrastructure, systems, and 
security for the relocated personnel. 


Since 2003, I&A has used the Bluemont Emergency Relocation 
Site as its alternate operating facility. The configuration of the 
Bluemont facility meets I&A COOP activities requirements and 
complies with FCD-1 requirements. I&A ERG members and 
senior leadership report to different buildings on the Bluemont 
Emergency Relocation Site. Due to the separation of senior 
leadership and the ERG, communication was not always timely. 
During the 2011 Eagle Horizon Exercise, I&A addressed the 
communication issue with technology that allowed senior 
leadership direct communication with ERG members.” Personnel 
unable to reach the Bluemont facility can telework to continue 
I&A Essential Functions. However, as the majority of I&A 


? The Eagle Horizon Exercise is an annual, integrated continuity exercise for all Federal departments and 
agencies, mandated by NSPD-51/HSPD-20 and the National Continuity Policy Implementation Plan. 
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Essential Functions depend on sensitive or classified information, 
telework is not feasible for most personnel. 


Most I&A division officials said that the Bluemont facility has 
enough resources to perform their Essential Functions. During a 
site visit to the Bluemont facility in June 2011, we determined that 
the size and configuration of both buildings that I&A occupies can 
accommodate 100 percent of the emergency personnel identified in 
I&A’s COOP plan. 


Orders of Succession 


FCD-1 requires departments and agencies to establish, promulgate, 
and maintain orders of succession to key positions. Orders should 
be of sufficient depth to ensure that the agency can manage and 
direct its essential functions and operations while remaining a 
viable part of the Federal Government throughout any emergency. 


I&A’s plan defines the order of succession of the Under Secretary, 
I&A Chief Intelligence Officer, and other I&A offices critical to 
ensuring leadership during an emergency. I&A Division succession 
orders are detailed in each division’s COOP implementation plan 
and maintained as separate documents. Each division is 
responsible for maintaining orders of succession for the office of 
Division Director. 


Delegations of Authority 


FCD-1 requires departments and agencies to predelegate 
authorities for making policy determinations and other decisions to 
ensure rapid response to any disaster or emergency requiring 
COOP plan activation. 


I&A’s COOP plan includes predelegation of authorities for making 
policy determinations and decisions, at headquarters and other 
organizational locations, that complies with FCD-1 requirements. 
The plan states that assumption of delegated authorities will occur 
when communications between I&A staff and primary office 
holders are severed for more than 2 hours. Authorities automatically 
transfer to the most senior available successor identified, and relief 
occurs when communication with the primary office holder is 
reestablished or a new authority is appointed. 


The plan’s delegations of authority and orders of succession are 


current and reflect changes in senior I&A leadership and I&A 
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organizational structure occurring in the past 2 years. According 
to I&A COOP program officials, personnel who could be 
delegated authorities in an emergency or be designated successors 
are trained or briefed on their roles. Each division’s COOP plan 
contains delegations of authority and orders of succession that 
comply with FCD-1. 


Devolution Planning 


FCD-1 requires that departments and agencies conduct devolution 
planning to identify how they will continue Essential Functions 
during increased threat situations or in the aftermath of an 
emergency or catastrophic disaster. Devolution planning refers to 
the preparation necessary to transfer statutory authority and 
responsibilities for Essential Functions of a department or agency 
to another organizational element, such as a field office, if an 
organization’s alternate operating facility or emergency relocation 
personnel are unavailable or incapacitated. 


As of November 2011, I&A had identified a devolution site but 
had not developed a feasible devolution plan to ensure that its 
Essential Functions would be continued if the I&A headquarters or 
the alternate operating facility is unavailable. 


Vital Records Management 


FCD-1 requires departments and agencies to identify, protect, and 
make readily available vital records, databases, and hard copy 
documents to support Essential Functions during COOP disasters 
and emergencies. There are two types of vital records: 


e Emergency Operating Records: Records and databases are 
essential to the functioning of or reconstituting of an 
agency during and after a continuity event. Emergency 
plans and directives; orders of succession; delegations of 
authority; staffing assignments; and related records of a 
policy or procedural nature that provide staff with guidance 
and information resources necessary for conducting 
operations during an emergency situation, and for resuming 
formal operations at its conclusion. 


e Legal and Financial Records: Records that are critical to 
carrying out an organization’s essential legal and financial 
functions and activities, and that protect the legal and 
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financial rights of individuals directly affected by its 
activities. 


The I&A COOP plan describes the need for a vital records 
program to support COOP operations, but the plan does not specify 
which records should be included. I&A program managers said 
that some vital records are paper-based and some are stored 
electronically at the permanent work center and alternate operating 
facility. However, the plan does not identify where vital records 
are stored; whether the records are paper-based, electronic, or both; 
or when the records should be updated. 


Interoperable Communications 


According to FCD-1, departments and agencies must establish 
interoperable communications that provide the capability to perform 
Essential Functions until normal operations can be resumed. 


In 2007, I&A had redundant systems only for its unclassified and 
SECRET networks. In July 2011, I&A conducted a successful test 
of the TOP SECRET network system. This was a major 
accomplishment, as the test demonstrated redundant communication 
capability with the IC and DHS components. Communications and 
databases are tested and updated regularly with software and 
changes requested by COOP program managers or division COOP 
coordinators. 


I&A has established interoperable and redundant communications, 
and systems are available to support communication with 
employees, Department leadership, and other elements and 
locations during an emergency. I&A officials said that I&A 
provides multiple communication modes capable of transmitting, 
receiving, and coordinating classified information at its alternate 
operating facility. This communication capability includes the use 
of the Joint Worldwide Intelligence Communications System and 
secure telephones and fax machines. '° I&A’s Information 
Technology Division is charged with ensuring continuity of 
communications at its primary workplace and the alternate 
operating facility. At the alternate operating facility, I&A has a 
full-time site coordinator and staff to ensure that communications 


10 The Joint Worldwide Intelligence Communications System is designed to meet the requirements for 
secure TOP SECRET/Sensitive Compartmented Information multimedia intelligence communications 
worldwide. 
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are reliable and updated with new databases or programs to support 
mission requirements. 


I&A is able to receive, coordinate, and deliver information at all 
security and classification levels. All I&A divisions have access to 
all files and databases that are needed to continue Essential 
Functions. 


To coordinate with personnel during an emergency, I&A uses the 
Government Emergency Telecommunications Service and the 
Wireless Priority Service emergency telephone and wireless 
services. All I&A ERG personnel have government-issued cellular 
telephones. 


Test, Training, Exercise, and Program Evaluation 


FCD-1 requires that departments and agencies assess, demonstrate, 
and improve their ability to execute COOP plans and programs 
through testing, training, and an exercise program. 


I&A has participated in several internal and government-wide 
COOP exercises, and has developed a test, training, and exercise 
program. The program validates, identifies issues for subsequent 
correction, and specifies aspects of COOP capabilities, procedures, 
systems, and facilities used in response to emergencies. 


I&A COOP officials said that COOP procedure and system tests 
have occurred during national COOP exercises and in association 
with events such as the 2009 Presidential inauguration, the 2009 
State of the Union Address, and the 2011 Eagle Horizon Exercise. 
I&A is starting to use more tabletop exercises to provide additional 
participants with opportunities to work through various scenarios 
and the COOP process.'' COOP program managers encourage all 
division-level COOP coordinators to conduct tabletop exercises to 
foster a better understanding of their COOP procedures and 
processes. 


I&A’s COOP program manager explained that I&A uses the 
automated Emergency Notification System to notify essential 
personnel of an emergency. The notification system will inform 
personnel of the event, the COOP level, and where and when to 


1l A tabletop exercise is a discussion guided by a facilitator(s) that simulates an emergency situation in an 
informal environment. The focus of the exercise is on training and familiarization with roles, procedures, 
and responsibilities. 
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report. Testing consists of calling or sending an email to all 
essential employees and ensuring that they received the message. 
COOP program officials said the system is tested regularly to 
ensure that contact information is correct. I&A also uses a “phone 
tree” system—a system of successive telephone calls that start and 
end with a specified person—as a backup procedure to inform 
personnel of COOP situations. 


As of November 2011, National-Level Exercises and internal 
tabletop exercises were scripted, with information communicated 
in advance. COOP program officials and division-level 
coordinators have weeks to plan and ensure that information is 
understood. For example, the 2011 Eagle Horizon Exercise 
provided predetermined scenarios and timelines for the event. 
Scripted exercises are useful in ensuring that personnel know the 
notification process, where to be, and how to access their systems 
to continue performing Essential Functions. However, the 2011 
Eagle Horizon Exercise tested the I&A notification system and 
how personnel deployed, but did not test the COOP process to 
react to a real emergency. 


The exercise was conducted as a tabletop exercise, with limited 
COOP activities for I&A divisions, and provided no opportunity 
for a “hot wash” or After Action Report to determine the success 
of the exercise.” '” Division-level coordinators interviewed said 
that no-notice exercises would be more practical in gauging how 
the COOP program functions. They also said that exercises should 
always be evaluated. 


I&A has ensured that its personnel are trained to implement COOP 
plans and carry out Essential Functions in a COOP situation. All 
division coordinators we interviewed said that they had completed 
the mandatory FEMA COOP training. Three division coordinators 
said that more training could enhance their knowledge of COOP 
and that they would be interested in attending additional training. 


I&A leadership requires all I&A personnel to complete the online 
FEMA COOP and emergency preparedness training through the 
DHS Intranet DHScovery website. This system informs COOP 
officials when I&A personnel have taken the basic-level COOP 


12 A hot wash normally includes all parties who participated in an exercise or response activities. These 
events are used to create an After Action Report to discuss and evaluate performance and areas requiring 
remediation. 
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orientation. Upon completion of the COOP orientation course, all 
I&A personnel should have a basic knowledge of COOP. 


An effective testing, training, and exercise program is vital to 
improve the ability of departments and agencies to manage and 
execute their COOP programs. With an effective testing, training, 
and exercise program in place, I&A should have confidence that its 
COOP program is capable of supporting the execution of Essential 
Functions during a COOP situation. 


Evaluation 


During exercises or real emergencies, it is important to record 
lessons learned so that COOP program evaluation and corrective 
action can occur. I&A does not have a process in its plan for 
documenting lessons learned, but is developing an official process 
for recording lessons learned and corrective action plans. 


I&A officials describe their process as collecting comments on 
questionnaires developed by the COOP program managers and 
then developing an after-action plan within 30 days based on those 
comments and observations. Then, a series of working group 
meetings are held to address issues that should be included in a 
corrective action plan. The corrective action plan prioritizes what 
actions or issues should be addressed to enhance responses to real- 
world threats. One program official said that approximately 

90 percent of the lessons learned from the 2010 Eagle Horizon 
Exercise were incorporated into the I&A plan for the 2011 exercise. 


Each division COOP team is responsible for collecting and 
recording its lessons learned or feedback. Usually, those lessons 
learned are maintained at the division level, but they can be 
elevated for inclusion in overall I&A lessons. There is no formal 
requirement, however, for divisions to share feedback with the 
I&A COOP program office. 


I&A uses FEMA’s Continuity Evaluation Tool to assess elements 
of continuity described in FCD-1 and Federal Continuity 
Directive-2 (FCD-2), Federal Executive Branch Mission Essential 
Function and Primary Mission Essential Function Identification 
and Submission Process (February 2008). The Continuity 


13 FCD-2 implements the requirements of FCD-1, Annex C. It provides guidance and direction to 
executive branch departments and agencies for identifying their Mission-Essential Functions and potential 
Primary Mission-Essential Functions. 
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Evaluation Tool supports the Readiness Report System, which 
evaluates an organization’s continuity plans and procedures. 
Exercises are scored by FEMA observers or self-scored by the 
COOP program manager. I&A retains the evaluations from 
multiple exercises to establish a baseline for the program. 


Reconstitution 


FCD-1 requires departments and agencies to provide reconstitution 
plans to transition from COOP status to an efficient normal 
operations status once the threat or disruption has passed. 


I&A’s COOP plan provides options for reconstitution from all 
disruption levels and movement from the COOP alternate 
operating facility or devolution site to the original facility or new 
operating site. It mentions that within 24 hours of an emergency 
relocation, the Office of the I&A Chief of Staff and the 
Information and Knowledge Management Division, in conjunction 
with the Continuity and Exercise Programs Branch, are to initiate 
and coordinate operations to salvage, recover, and restore I&A 
after receiving approval from appropriate law enforcement and 
emergency services officials. When the Under Secretary for I&A 
or other authorized official deems that the emergency situation has 
ended and is unlikely to recur— 


e Operations may continue from the alternate operating 
facility/emergency relocation site; 

e I&A headquarters may be reconstituted with returning 
staff; or 

e I&A may begin to reconstitute in another designated 
location. 


I&A’s COOP plan requires each division to appoint a representative 
to the Reconstitution Working Group. This working group is led 
by the Reconstitution Manager, who oversees the transition. In 
planning for reconstitution, the Reconstitution Working Group and 
Reconstitution Manager are tasked with the following: 


e Coordinating with the General Services Administration to 
obtain office space when I&A’s alternate operating facility 
is deemed uninhabitable; 

e Developing space allocation and facility requirements; 

e Developing a time-phase plan, listing functions and projects 
in order of priority for resuming normal operations; and 
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e Developing procedures, as necessary, for reconstituting 
I&A staff. 


However, I&A’s reconstitution process has not been fully tested. 
As a result, it may not be adequate and will need to be tested to 
ensure conformity with FCD-1. 


Human Capital and Resources 


FCD-1 requires departments and agencies to ensure that human 
capital strategies for their continuity staff are adaptable to 
changing circumstances and a variety of emergencies. 


I&A’s COOP plan includes the required procedures and guidance 
on human resource issues related to continued operations. I&A 
has a comprehensive plan that responds to the threats its employees 
are likely to encounter during an emergency. The plan includes the 
human factors that need to be considered during a crisis, such as 
expected roles and responsibilities, staffing, pay, and notification 
protocols. The plan indicates detailed administrative and 
personnel services support procedures for deploying I&A staff 
during an emergency. I&A has addressed telework as an 
emergency strategy in its COOP plan and program, albeit on a 
limited basis because of the classified networks and databases 
needed to complete I&A’s mission. I&A’s draft plan will address 
the use of existing DHS component field infrastructures and 
consider other options such as joint or shared facilities. 


Recommendations 


We recommend that the Under Secretary for Intelligence and 
Analysis/Chief Intelligence Officer: 


Recommendation #1: Develop an I&A COOP policy to codify 
COOP roles and responsibilities of all I&A divisions and offices in 
maintaining and enhancing COOP plans. 


Recommendation #2: Include all I&A division-level Essential 
Functions as annexes in I&A’s overall COOP Plan. 


Recommendation #3: Use the current emergency relocation site 
as an interim location for I&A devolution and establish a combined 
permanent and rotational cadre of I&A personnel to staff the site, 
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while continuing to pursue options for establishing an emergency 
relocation site. 


Recommendation #4: Incorporate no-notice exercises that 
include realistic and factually based scenarios to simulate real- 
world threats, hazards, incidents, and events to gauge and evaluate 
I&A’s COOP program functionality. 


Recommendation #5: Conduct hot washes or similar actions to 
create After Action Reports for all COOP exercises or real-world 
events when COOP activation is considered or actual execution 
occurs, and use these reports to enhance COOP program 
capabilities. 


We evaluated the consolidated I&A and USCG written comments 
and have made changes to the report where we deemed 
appropriate. A summary of the written response to the report 
recommendations and our analysis of the response follow each 
recommendation. A copy of Department’s consolidated response, 
in its entirety, is included as appendix C. 


In addition, we received technical comments from I&A and USCG 
and incorporated these comments into the report where appropriate. 
I&A concurred with Recommendations 1, 2, 4, and 5, and did not 
concur with Recommendation 3. USCG concurred with 
Recommendations 6, 7, and 8 (below). We appreciate the 
comments and contributions made by each entity. 


Management Comments and OIG Analysis 


Management Response: I&A officials concurred with 
Recommendation 1. In its response, I&A said it has developed a 
draft continuity policy to codify the roles and responsibilities of 
I&A divisions and offices in maintaining and enhancing the 
program. In addition, I&A’s continuity policy provides 
documentation of nonoperational program requirements, allowing 
the updated I&A continuity plan to focus on operational 
requirements and ensuring that continuity applies to all I&A 
personnel and not just the Emergency Response Group. I&A 
expects to publish this policy by September 30, 2012. 


OIG Analysis: We consider I&A’s actions responsive to the 
intent of Recommendation 1, which is resolved and open. This 
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recommendation will remain open pending our receipt of the 
updated I&A continuity policy. 


Management Response: I&A officials concurred with 
Recommendation 2. In its response, I&A said it is adding the 
division-level Essential Functions to the existing I&A continuity 
plan as well as the Essential Functions annex of the draft updated 
I&A continuity plan. I&A expects to finalize these by 
September 30, 2012. 


OIG Analysis: We consider I&A’s actions responsive to the 
intent of Recommendation 2, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
updated I&A Continuity plan and the Essential Functions annex. 


Management Response: I&A officials did not concur with 
Recommendation 3. In its response, I&A said that, while this 
recommendation was valid during OIG fieldwork, because I&A 
had not identified a devolution site, I&A has since identified a 
devolution site and is training site personnel to perform the priority 
I&A Essential Functions and tasks. Rather than invest resources in 
an interim solution, I&A is focusing on the required equipment and 
training enhancements for the permanent devolution site. I&A 
expects to complete the first phase of these enhancements this 
year. I&A believes these actions address Recommendation 3 and 
respectfully requests it be closed. 


OIG Analysis: We consider I&A’s actions responsive to the 
intent of Recommendation 3, which is resolved and open. In 
response to I&A technical comments, this recommendation was 
modified from the draft report and now reads as follows: 


Revised Recommendation #3: Use the current emergency 
relocation site as an interim location for I&A devolution and 
establish a combined permanent and rotational cadre of I&A 
personnel to staff the site, while continuing to prepare devolution 
site for its role. 


This recommendation will remain open pending our receipt of 
documentation that evidences the plan for the identified devolution 
site. 


Management Response: I&A officials concurred with 
Recommendation 4. In its response, I&A said it will conduct the 
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first in a series of annual no-notice COOP exercises to be 
conducted prior to the end of this calendar year. 


OIG Analysis: We consider I&A’s actions responsive to the 
intent of Recommendation 4, which is resolved and open. This 
recommendation will remain open pending our receipt of 
documentation that evidences the conduct of a no-notice COOP 
exercise. 


Management Response: I&A officials concurred with 
Recommendation 5. In its response, I&A said that rather than 
conducting a staged hot wash at the conclusion of exercise Eagle 
Horizon 2011, as was done for Eagle Horizon 2008, 2009, and 
2010, I&A required each 2011 participant to complete an 
observation and a participation form, thereby capturing all I&A 
Eagle Horizon 2011 participants’ issues in writing. The reports 
were then analyzed by I&A Continuity and Exercise Programs 
Branch personnel for trends to include in the DHS-wide hot wash, 
the I&A Eagle Horizon 2011 Quick Look After Action Report, and 
the I&A Corrective Actions Database. The Corrective Actions 
Database then tracks the status of in-process and resolved issues. 
Further, I&A will reincorporate staged hot washes and the creation 
of After Action Reports at the conclusion of all future COOP 
exercises and real-world events. I&A believes these actions 
address Recommendation 5 and respectfully requests it be closed. 


OIG Analysis: We consider I&A’s actions responsive to the 
intent of Recommendation 5, which is resolved and closed. No 
further reporting concerning this recommendation is necessary. 


United States Coast Guard Intelligence and Criminal 
Investigations 


For more than 200 years, USCG has safeguarded our Nation’s maritime 
interests in the heartland, in the ports, at sea, and around the globe. It 
protects the maritime economy and the environment, defends our maritime 
borders, saves those in peril at sea, and has the following 11 missions: 


Ports, waterways, and coastal security 
Drug interdiction 

Aids to navigation 

Search and rescue 

Living marine resources 
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Marine safety 

Defense readiness 

Migrant interdiction 

Marine environmental protection 
Ice operations 

Other law enforcement 


USCG CG-2’s mission is to direct, coordinate, and oversee intelligence 
and investigative operations and activities that support all USCG 
objectives. '* It conducts intelligence activities as defined in Executive 
Order 12333 and as part of the Law Enforcement Intelligence Program.” 
CG-2 includes headquarters elements as well as elements colocated with 
other intelligence departments and agencies (see figure 3). 


Figure 3: CG-2 Organizational Structure 


Atlantic Intel (LANT-2) - Portsmouth, VA 
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Assistant Commandant and 
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Plans & Policy Coordination Cryptologic Investigative 
Center Group Service 


Source: CG-2. 


14 Hereinafter, USCG CG-2 is referred to as CG-2. 

'S Executive Order 12333 § 1.4 requires that the agencies within the IC shall be in accordance with 
applicable U.S. law and with the other provisions of this order in conducting intelligence activities 
necessary for the conduct of foreign relations and the protection of the national security of the United 
States. 
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COOP Program Evolution 


Due to USCG’s military organizational structure and principles, continuity 
capabilities have always been established in policies and guidance. CG-2 
COOP plan development has been continually updated since USCG’s 
inclusion in the IC in 2001. The plan has evolved from being military 
based to including all requirements in FCD-1. CG-2 leadership and 
program managers have reshaped COOP policies to satisfy USCG, DHS, 
and IC requirements. CG-2 senior leaders understand how continuity 
plans are developed and maintained. 


Program officials define COOP as the ability of CG-2 and its leadership to 
continue performing its Essential Functions in the event that USCG 
headquarters is unsafe, unusable, or inaccessible. CG-2 must establish an 
operational capability and perform Essential Functions within 12 hours of 
COOP activation and sustain those functions for up to 30 days or until 
normal operations resume. 


CG-2 has defined its Essential Functions, participates in government-wide 
and internal COOP exercises, and conducts periodic informational 
meetings to identify its COOP preparedness level. USCG officials said 
they maintain a level of COOP capability that would sustain performance 
of its Essential Functions. 


CG-2 has identified an ERG to ensure continuation of its Essential 
Functions after COOP activation. If normal USCG operations are 
disrupted, the Assistant Commandant or a designated successor will 
activate the CG-2 COOP plan. Members of the ERG will then relocate to 
their respective alternate operations facilities to continue CG-2’s Essential 
Functions. 


Support and Planning Efforts 


The COOP program has consistent senior and midlevel leadership 
support, and senior officials have a stake in ensuring that CG-2 
programs comply with all Federal regulations and policies. CG-2 
management has recently dedicated more efforts to building COOP 
awareness and support because it believes more outreach will 
improve the accountability, oversight, and visibility of its COOP 
programs. 


As of November 2011, CG-2 was using a 2009 plan as guidance. 
The 2009 plan addresses all the requirements for an effective 
COOP program. However, prioritization of Essential Functions 
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and clearly defined order of succession and delegation of authority 
need improvement. Prioritization of Essential Functions will help 
determine where and how resources will be most effective. Order 
of succession and delegation of authority are two distinct functions, 
and better delineation is needed in the CG-2 COOP plan. CG-2 is 
drafting a new plan, which it expects to complete by summer 2012. 


CG-2’s Office of Plans and Policy Division manage its COOP 
program. A designated COOP program manager develops, 
implements, and maintains its COOP plan. CG-2 has trained 
personnel to develop, maintain, and execute a COOP program 
within established directives and policies. The CG-2 COOP 
program manager has other assigned duties. Program officials said 
that more of the program manager’s time should be dedicated to 
the COOP program; however, other duties may take priority. 


The divisions within CG-2 have designated COOP managers who 
work with COOP program officials to ensure that their plan 
encompasses all of CG-2. All division-level managers have 
functional COOP knowledge, with some possessing expert 
knowledge in maintaining a COOP program. COOP planning 
occurs at all CG-2 levels and takes into account different USCG 
work functions, depending on the emergency. 


Working Group Collaboration 


CG-2 participates in the same external Office of Director of 
National Intelligence COOP working groups and DHS internal 
working groups as I&A. CG-2 provides a different perspective to 
the working groups because of USCG’s unique mix of missions— 
military, law enforcement, and intelligence. 


Implementing Federal Continuity Directive-1 Requirements 


Essential Functions 


Each Essential Function contains Essential Tasks that support each 
function. CG-2’s Essential Functions are as follows: 


e Protective service operations for the USCG Commandant 
and Vice Commandant, or alternates 
e Intelligence support to USCG senior leadership and DHS 
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e Intelligence systems/information technology and related 
connectivity 

e Physical/personnel security systems and safeguards 

e Intelligence support to area and subordinate field 
commanders 

e Investigative operations in support of area and subordinate 
field commanders 

e Counterintelligence operations 

e IC requirements: Continued support for all necessary IC 
requirements 


As a result of changes in processes and new information, CG-2’s 
2009 COOP plan needs to be updated. COOP personnel said the 
Essential Functions and annexes need to be updated and 
prioritized. Because USCG is a multimission organization, 
prioritization will be challenging, but necessary to execute duties, 
allocate resources, and perform exercises more effectively. Until 
the plan is revised, it is difficult to assess which areas require 
resource modification. 


Alternate Operating Facilities 


CG-2 COOP personnel deploy to multiple locations during a 
COOP event. The specific relocation site will be determined by 
the Commandant or successor based on the nature of the incident 
or threat. However, as of November 2011, the location for all 
scenarios is the Operations Systems Center for the Intelligence 
Command Center for CG-2 essential staff and USCG Atlantic area 
headquarters for CG-2 Deputy Commandant and the Vice 
Commandant. CG-2 offices and members colocated with a hosting 
organization will work with that organization in support of USCG 
functions. Also, CG-2 personnel may need to relocate to the 
Bluemont Emergency Relocation Site with DHS intelligence 
elements. 


The Operations Systems Center is a government-owned, 
contractor-operated facility, which provides full support for the 
operationally focused USCG automated information systems. The 
Operations Systems Center has a full-time staff that maintains all 
its information systems. The center meets FCD-1 requirements for 
an alternate operating facility, and its configuration supports 
USCG and its 11 mission areas. The Operations Systems Center 
has space to accommodate current CG-2 COOP requirements and 
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maintains unclassified, SECRET, and TOP SECRET systems 
needed to continue CG-2’s Essential Functions. 


Orders of Succession 


The COOP plan states that order of succession will occur in the 
absence, disability, or death of the CG-2 Assistant Commandant. 
Successors to the position of Assistant Commandant will serve 
until CG-2 is able to return to duty or a successor is chosen by the 
USCG Commandant. 


However, the plan does not clearly establish order of succession. 
No wording or displays illustrate who will succeed the Assistant 
Commandant or other positions if the person is unavailable to 
assume command. 


Delegations of Authority 


The CG-2 COOP plan includes predelegation of authorities that are 
in compliance with FCD-1 for making policy determinations and 
decisions at headquarters and other organizational locations. 


However, under delegation of authorities, two charts allude to 
succession of the program management and the delegation of 
authority for the intelligence advisors. '° This may lead to 
confusion over who is the successor for the CG-2 program and 
who has intelligence advisor authority. USCG headquarters COOP 
officials said the plan’s succession of command and delegations of 
authority need to be better defined. 


Devolution Planning 


USCG headquarters devolution planning supports overall 
continuity planning and addresses multiple threats and all-hazards 
emergency events that may render USCG leadership unavailable or 
incapable of supporting the execution of its Essential Functions 
from either USCG headquarter or alternate operating facilities. 


USCG headquarters’ Disaster and Continuity Division has 
developed a devolution option for continuity that incorporates 
succession of command and geographical separation of leadership, 
and addresses how USCG will conduct Essential Functions during 
an increased threat situation or in the aftermath of a catastrophic 


16 CG-2 COOP plan, August 2009. 
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emergency. When the Commandant or a Continuity of Government 
Readiness change directs geographic separation of leadership, the 
ERG will proceed to Atlantic Area Headquarters. When the 
Commandant is unable to perform his or her duties, the Vice 
Commandant will assume the office and perform the duties with 
the support of the ERG and the Atlantic Area staff. 


Vital Records Program 


CG-2’s COOP plan identifies each vital record and its current 
location. The plan states that each record is accessible electronically 
at the primary facility in addition to being pre-positioned 
electronically at the alternate operating facilities. To ensure the 
redundancy and personnel resources needed to perform current 
missions, USCG requires each CG-2 member to have a “drive 
away kit.” The kit is to include any paper-based copies of the vital 
records needed to perform an Essential Function, Essential Task, 

or any other important function while operating under COOP 
conditions. 


However, COOP officials said that the Vital Records Program 
needs to define responsibilities, checklists, overall duties, and 
missions better. 


Interoperable Communications 


CG-2 has interoperable and redundant systems available to support 
communication with employees, Department leadership, and other 
elements and locations during an emergency. CG-2 program 
officials said that USCG has multiple communication modes at its 
alternate operating facilities, including unclassified, SECRET, and 
TOP SECRET levels. The USCG headquarters Intelligence 
Security Management Division has continuity of communications 
at the primary workplace and the alternate operating facilities. At 
the facilities, USCG has full-time site coordinators with staff to 
ensure that communications are reliable and continuously updated. 


USCG alternate operating facilities can communicate with all IC 
members’ systems through the use of the Joint Worldwide 
Intelligence Communication System and secure telephones and fax 
machines. CG-2 can receive, coordinate, and deliver information 
at all classification and security levels. At each alternate operating 
facility, CG-2 personnel have access to all files and databases to 
continue Essential Functions. 


DHS?’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 


Page 29 


CG-2 uses the Government Emergency Telecommunications 
Service and the Wireless Priority Service to ensure access to 
telephone and wireless communications to contact and coordinate 
with personnel in an emergency. All CG-2 personnel have cellular 
telephones. In some situations, personal pagers can be used in 
classified spaces. 


Test, Training, Exercise, and Evaluation Program 


Testing, training, and exercising COOP capabilities are essential to 
demonstrate, assess, and improve CG-2’s ability to execute COOP 
plans. Training familiarizes COOP personnel with the Essential 
Functions and Essential Tasks they may have to perform in an 
emergency. Periodic testing also ensures that equipment is 
available and maintained and procedures are validated. 


The USCG National Command Center can activate the COOP 
notification process by using the Alert and Notification automated 
system. The senior officer available within CG-2 can also use the 
phone tree method to activate CG-2 COOP. 


CG-2 participates in several internal and government-wide COOP 
exercises. Its test, training, and exercise program works in concert 
with USCG’s overall headquarters plan. The program validates, 
identifies issues for subsequent correction, and specifies aspects of 
COOP capabilities, procedures, systems, and facilities used in 
response to an emergency. 


CG-2’s continuity training and exercises sufficiently prepare and 
assess USCG’s ability to conduct its Essential Functions during a 
significant emergency. However, CG-2 training could benefit 
from more realistic scenarios and better participation among all 
divisions. For example, during the National-Level Exercises, 
CG-2’s primary focuses are testing equipment, communication 
systems, and access to records. However, CG-2 has not tested full 
COOP capability, as scenarios have not required complete resource 
deployment. 


Evaluation 


CG-2 has a consistent process for addressing recommendations or 
gaps identified from lessons learned during exercises. The 2009 
and 2010 National-Level Exercise reports we reviewed contained 
sections where the COOP manager identifies action items and 
recommendations on how to complete those items, and designates 
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which staff or group is responsible for each item. The After 
Action Reports were in the same format; however, they contained 
no consistent completion schedules. 


After an exercise, initial comments are collected, with 
approximately 30 days allowed to draft an After Action Report. 
Comments come from feedback questions generated by the COOP 
program managers. A series of working group meetings are held 
to address issues that should be included in a corrective action 
plan. The plan attempts to prioritize what should be worked on to 
respond to real-world threats. 


CG-2 uses the FEMA Continuity Evaluation Tool to assess 
elements of continuity outlined in FCD-1 and FCD-2. It also uses 
reports from DHS headquarters and I&A as part of the internal 
DHS working groups. Each division COOP team is responsible 
for collecting and recording its lessons learned or feedback. The 
lessons learned are incorporated into corrective action plans for 
CG-2, but can also be elevated for incorporation into overall 
USCG headquarters and DHS headquarters lessons learned. 
Although there is no mandate for divisions to share feedback 
outside USCG, CG-2 has a standard general practice to voluntarily 
provide feedback and follow up input from COOP lessons learned 
and After Action Reports to USCG headquarters COOP and 
planning offices, the Office of the Director of National Intelligence 
Exercise and Plans Office, I&A, and DHS headquarters. 


Lessons learned are incorporated into the COOP plan as solutions 
or enhancements for corrective action. According to CG-2 COOP 
program officials, when new lessons learned are not in the plan, 
new guidance for the next exercise or emergency may be issued. 


Reconstitution 


The USCG headquarters COOP plan states that the Commanding 
Officer of the Headquarters Support Command is responsible for 
reconstitution activities for USCG headquarters, which ensure that 
adequate facilities are available to house and support the 
Commandant and headquarters staff in a COOP environment. 


CG-2 is responsible for coordinating with Headquarters Support 
Command to ensure that space, systems, records, and security 
requirements are met at the reconstituted site. When that is not 
feasible, CG-2 will decide how to house USCG’s Intelligence 
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Program assets and resources to ensure that all Essential Functions 
and Essential Tasks are fulfilled to the extent possible. 


Human Capital and Resources 


CG-2’s COOP plan includes the required procedures and guidance 
on human resource issues related to continued operations. The 
plan covers human capital resources and addresses the flexibilities 
that exist to assist managers and employees in an emergency. The 
plan covers communicating with employees, recall processes, pay 
and staffing flexibilities, and employee roles and responsibilities. 


CG-2’s plan also ensures that COOP capabilities take advantage of 
existing field infrastructures and considers other options, such as 
telecommuting locations, residential telework, virtual offices, and 
joint or shared facilities. Individuals who are unable to reach the 
alternate operating facilities and those who are not mission 
essential have options in communicating with managers and 
leadership to continue the USCG mission. 


Recommendations 


We recommend that the CG-2 Assistant Commandant for 
Intelligence and Criminal Investigations: 


Recommendation #6: Determine Essential Function priorities 
and appropriate resource requirements for each function in the 
updated CG-2 COOP plan. 


Recommendation #7: Clearly list and define order of succession 
and delegations of authority in the updated COOP plan and include 
the orders of succession in Vital Records, as stated in FCD-1. 


Recommendation #8: Incorporate no-notice exercises into COOP 
testing and training and base such exercises on real-world 
scenarios that are focused on the CG-2 mission. 


Management Comments and OIG Analysis 


Management Response: USCG officials concurred with 
Recommendation 6. In its response, USCG said that the corrective 
action plan will include a new section in the COOP plan that 
identifies each CG-2 office and/or unit’s Essential Function 
priorities and the appropriate resource requirements assigned to 
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each function. USCG expects to incorporate this recommendation 
into the updated CG-2 COOP plan by October 1, 2012. 


OIG Analysis: We consider USCG’s actions responsive to the 
intent of Recommendation 6, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
updated CG-2 COOP plan. 


Management Response: USCG officials concurred with 
Recommendation 7. In its response, USCG said that the corrective 
action plan will include a new section in the COOP plan that 
identifies each CG-2 office and/or unit’s order of succession and 
delegations of authority. This section will also include orders of 
succession in Vital Records, as stated in FCD-1. USCG expects to 
incorporate this recommendation into the updated CG-2 COOP 
plan by October 1, 2012. 


OIG Analysis: We consider USCG’s actions responsive to the 
intent of Recommendation 7, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
updated CG-2 COOP plan. 


Management Response: USCG officials concurred with 
Recommendation 8. In its response, USCG said that the corrective 
action plan will include a new section in the COOP plan that 
details incorporating no-notice exercises into COOP testing and 
training, basing such exercises on real-world scenarios that are 
focused on the CG-2 mission. The results and lessons learned 
from the exercise will be documented in After Action Reports. 
USCG expects to incorporate this recommendation into the 
updated CG-2 COOP plan by October 1, 2012. 


OIG Analysis: We consider USCG’s actions responsive to the 
intent of Recommendation 8, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
updated CG-2 COOP plan. 


Conclusion 


I&A and CG-2 have developed COOP plans that enable personnel to 
conduct Essential Functions at their alternate operating facilities during 
emergencies. Both plans establish alternate work sites, interoperable 
communications, and dedicated resources, enabling Essential Functions to 
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be performed. I&A and CG-2 program offices have made COOP planning 
a priority and aligned their programs with Federal regulations and 
guidelines. 


With complete COOP plans, I&A and CG-2 are able to support, 
coordinate, and direct homeland security issues. As a result, DHS’ IC 
members are prepared to provide essential services during a significant 
national event. 
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Appendix A 


Purpose, Scope, and Methodology 


In January 2010, the Assistant Inspectors General for Inspections 
Working Group of the Intelligence Community Inspectors General 
Forum agreed to conduct evaluations of COOP and Intelligence 
Readiness programs within their organizations. These evaluations 
were to assess COOP for elements and capabilities in each 
organization that are funded by the National Intelligence Program. 


Within DHS, I&A and CG-2 are responsible for ensuring the 
integration and continuity of intelligence to and from the IC during 
regular operational periods and national emergencies. 


We assessed the status of the I&A and CG-2 COOP programs that 
pertain to the IC and determined whether policies, guidance, and 
processes are effective; whether Essential Functions can be 
performed during a wide range of emergencies; and the capability 
for sharing information between DHS and the IC. Specifically, our 
objectives were to determine whether— 


e The definitions of COOP that I&A and CG-2 use align with 
the National Continuity Policy; 

e I&A and CG-2 COOP plans adequately address 
requirements set forth in the National Continuity Policy; 

e COOP training and exercises test capabilities and identify 
potential areas of improvement; and 

e New planning efforts incorporate lessons learned and 
corrective actions from prior exercises or actual events. 


To achieve our objectives, we reviewed documents such as 
guidance, policies, procedures, and plans, and performed data 
analysis of information provided by DHS regarding organizational 
COOP. We interviewed DHS officials who have a role in 
preparing, planning, maintaining, and implementing COOP, as 
well as officials from the Federal Bureau of Investigation and 
Department of State. This allowed us to assess the effectiveness of 
DHS efforts and the level of collaboration among DHS 
components, external Federal departments and agencies, and the IC. 


Our review began in June 2011 and concluded in November 2011. 
We initiated this review under the authority of the Inspector 
General Act of 1978, as amended, and according to the Quality 
Standards for Inspections issued by the President’s Council on 
Integrity and Efficiency. 
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Appendix B 
Recommendations 


We recommend that the Under Secretary for Intelligence and 
Analysis/Chief Intelligence Officer: 


Recommendation #1: Develop an I&A COOP policy to codify 
COOP roles and responsibilities of all I&A divisions and offices in 
maintaining and enhancing COOP plans. 


Recommendation #2: Include all I&A division-level Essential 
Functions as annexes in I&A’s overall COOP Plan. 


Revised Recommendation #3: Use the current emergency 
relocation site as an interim location for I&A devolution and 
establish a combined permanent and rotational cadre of I&A 
personnel to staff the site, while continuing to prepare devolution 
site for its role. 


Recommendation #4: Incorporate no-notice exercises that 
include realistic and factually based scenarios to simulate real- 
world threats, hazards, incidents, and events to gauge and evaluate 
I&A’s COOP program functionality. 


Recommendation #5: Conduct hot washes or similar actions to 
create After Action Reports for all COOP exercises or real-world 
events when COOP activation is considered or actual execution 
occurs, and use these reports to enhance COOP program 
capabilities. 


We recommend that the CG-2 Assistant Commandant for 
Intelligence and Criminal Investigations: 


Recommendation #6: Determine Essential Function priorities 
and appropriate resource requirements for each function in the 
updated CG-2 COOP plan. 


Recommendation #7: Clearly list and define order of succession 
and delegations of authority in the updated COOP plan and include 
the orders of succession in Vital Records, as stated in FCD-1. 


Recommendation #8: Incorporate no-notice exercises into COOP 
testing and training and base such exercises on real-world 
scenarios that are focused on the CG-2 mission. 
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Appendix C 
Management Comments to the Draft Report 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 


U.S. Department of Homeland Security 
Washington, DC 20528 


<< Homeland 
= Security 


APR 1 3 2012 


MEMORANDUM FOR: Charles K. Edwards 
Acting Inspector General, 


FROM: Caryn A. Wagner LAMAAN / 
Under Secretary for Intelligerice and Analysi 


( 
SUBJECT: Draft Report OIG-10-150-ISP-I&A, USCG, DHS’ Intelligence 
Community Members’ Continuity of Operations and Intelligence 
Readiness 


The Office of Intelligence and Analysis (I&A) and the US Coast Guard (USCG) appreciate the 
opportunity to review and comment on the Office of Inspector General (OIG) draft report OIG- 
10-150-ISP-I&A, USCG, DHS’ Intelligence Community Members’ Continuity of Operations and 
Intelligence Readiness. 1&A and USCG CG-2 are actively resolving the issues identified in the 
report. 


For recommendations directed to the Under Secretary for Intelligence and Analysis/Chief 
Intelligence Officer: 


Recommendation #1: Develop an I&A Continuity of Operations (COOP) policy to codify 
COOP roles and responsibilities of all divisions and offices in maintaining and enhancing COOP 
plans. 


DHS Response: Concur. I&A has developed a draft continuity policy to codify the roles and 
responsibilities of I&A divisions and offices in maintaining and enhancing the program. 
Additionally, the I&A Continuity Policy provides documentation of non-operational program 
requirements, allowing the updated I&A Continuity Plan to focus on operational requirements 
and ensuring that continuity applies to all I&A personnel and not just the Emergency Response 
Group. I&A expects to publish this policy by September 30, 2012. 


Recommendation #2: Include all I&A division-level Essential Functions as annexes in I&A’s 
overall COOP Plan. 


DHS Response: Concur. I&A is adding the division-level Essential Functions to the existing 


I&A Continuity Plan as well as the Essential Functions Annex of the draft updated I&A 
Continuity Plan. I&A expects to finalize these by September 30, 2012. 
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Appendix C 
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UNCLASSIFIED//FOR OFFICIAL USE ONLY 


Recommendation #3: Use the current emergency relocation site as an interim location for I&A 
devolution and establish a combined permanent and rotational cadre of I&A personnel to staff 
the site while continuing to pursue options for establishing an emergency relocation site. 


DHS Response: I&A Does Not Concur. While this recommendation was valid during the 
OIG’s fieldwork because I&A had not identified a devolution site, I&A has since identified a 
devolution site and is training site personnel to perform the priority I&A essential functions and 
tasks. Rather than invest resources in an interim solution, I&A is focusing on the required 
equipment and training enhancements for the permanent devolution site, I&A expects to 
complete the first phase of these enhancements this year. 


I&A believes these actions address the intent of the recommendation and respectfully requests 
this recommendation be closed. 


Recommendation #4: Incorporate no-notice exercises that include realistic and factually based 
scenarios to simulate real-world threats, hazards, incidents, and events to gauge and evaluate 
I&A’s COOP program functionality. 


DHS Response: Concur. I&A will conduct the first in a series of annual no-notice COOP 
exercises to be conducted prior to the end of this calendar year. 


Recommendation #5: Conduct hot washes or similar actions to create After Action Reports for 
all COOP exercises or real-world events when COOP activation is considered or actual 
execution occurs, and use these reports to enhance COOP program capabilities. 


DHS Response: Concur. Rather than conducting a staged hot wash at the conclusion of 
Exercise EAGLE HORIZON (EH) 11, as was done for EH 8, 9, and 10, I&A required each EH 
11 participant to complete an observation and a participation form, thereby capturing all I&A EH 
11 participants’ issues in writing. The reports were then analyzed by I&A Continuity and 
Exercise Programs Branch personnel for trends to include in the DHS-wide hot wash, the I&A 
EH 11 Quick Look After Action Report, and the I&A Corrective Actions Database. The 
Corrective Actions Database then tracks the status of in-process and resolved issues. Further, 
I&A will reincorporate staged hot washes and the creation of After Action Reports at the 
conclusion of all future COOP exercises and real-world events. 


I&A believes these actions address the recommendation and respectfully requests this 
recommendation be closed. 


For recommendations directed to the CG-2 Assistant Commandant for Intelligence and 
Criminal Investigations: 


Recommendation #6: Determine Essential Function priorities and appropriate resource 
requirements for each function in the updated CG-2 COOP plan. 
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USCG CG-2 Response: Concur. The corrective action plan will include a new section in the 
COOP plan that identifies each CG-2 office and/or units essential function priorities and the 
appropriate resource requirements assigned to each function. USCG expects to incorporate this 
recommendation into the updated CG-2 COOP plan by October 1, 2012. 


Recommendation #7: Clearly list and define order of succession and delegations of authority in 
the updated COOP plan and include the orders of succession in Vital Records, as stated in FCD- 
l. 


USCG CG-2 Response: Concur. The corrective action plan will include a new section in the 
COOP plan that identifies each CG-2 office and/or units’ order of succession and delegations of 
authority. This section will also include orders of succession in Vital Records, as stated in FCD- 
1. USCG expects to incorporate this recommendation into the updated CG-2 COOP plan by 
October 1, 2012. 


Recommendation #8: Incorporate no-notice exercises into COOP testing and training and base 
such exercises on real-world scenarios that are focused on the CG-2 mission. 


USCG CG-2 Response: Concur. The corrective action plan will include a new section in the 
COOP plan that details incorporating no-notice exercises into COOP testing, and training basing 
such exercises on real-world scenarios that are focused on the CG-2 mission. The results and 
lessons learned from the exercise will be documented in after-action reports. USCG expects to 
incorporate this recommendation into the updated CG-2 COOP plan by October 1, 2012. 


We look forward to continuing our work with you to ensure all required actions are completed. 


Should you require additional information, please do not hesitate to contact me or have your staff 
contact Keith Jones at 202-282-9553 or David Plaza at 202-447-3099. 
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Director, GAO/OIG Liaison Office 
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Chief Privacy Officer 
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Office of the Director of National Intelligence 
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ADDITIONAL INFORMATION AND COPIES 


To obtain additional copies of this report, please call the Office of Inspector General 
(OIG) at (202)254-4100, fax your request to (202)254-4305, or e-mail your request to 
our OIG Office of Public Affairs at DHS-OIG.OfficePublicAffairs@dhs.gov. For 
additional information, visit our OIG website at www.oig.dhs.gov or follow us on Twitter 
@dhsoig. 


OIG HOTLINE 
To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 
or noncriminal misconduct relative to Department of Homeland Security programs and 
operations: 
e Call our Hotline at 1-800-323-8603 
e Fax the complaint directly to us at (202)254-4292 
e E-mail us at DTHSOIGHOTLINE@dhs.gov; or 
e Write to us at: 
DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigation - Hotline, 
245 Murray Drive SW, Building 410 
Washington, DC 20528 


The OIG seeks to protect the identity of each writer and caller. 


